#!/usr/bin/env bash
# One-time: allow passwordless sudo for docker/Isaac/NemoClaw bootstrap commands.
# Run: bash scripts/enable_passwordless_agent_sudo.sh
set -euo pipefail
USER_NAME="${SUDO_USER:-$USER}"
FILE="/etc/sudoers.d/99-cursor-agent-${USER_NAME}"
TMP=$(mktemp)
cat >"$TMP" <<EOS
# Cursor agent autonomy on Jetson Thor — generated by enable_passwordless_agent_sudo.sh
# SETENV: Cursor/agents often invoke sudo -E; without this you get
# "sorry, you are not allowed to preserve the environment".
Defaults:${USER_NAME} !env_reset
Defaults:${USER_NAME} env_keep+=FASTRTPS_DEFAULT_PROFILES_FILE
Defaults:${USER_NAME} env_keep+=RMW_IMPLEMENTATION
Defaults:${USER_NAME} env_keep+=ROS_DOMAIN_ID
Defaults:${USER_NAME} env_keep+=ROS_DISTRO
${USER_NAME} ALL=(ALL) NOPASSWD:SETENV: /usr/bin/docker, /usr/bin/dockerd, /bin/systemctl, /usr/bin/systemctl, /usr/bin/apt, /usr/bin/apt-get, /usr/bin/dpkg, /usr/bin/isaac-ros, /usr/local/bin/isaac-ros, /home/${USER_NAME}/.local/bin/nemoclaw, /home/${USER_NAME}/.local/bin/openshell, /usr/bin/usermod, /usr/sbin/usermod, /usr/bin/tee, /usr/bin/python3, /bin/bash, /usr/bin/bash, /usr/bin/curl, /bin/chmod, /bin/chown, /usr/bin/install, /usr/bin/mkdir, /bin/mkdir, /usr/bin/mv, /bin/mv, /usr/bin/cp, /bin/cp, /usr/bin/rm, /bin/rm, /usr/bin/ln, /bin/ln, /usr/sbin/service, /usr/bin/journalctl, /usr/bin/pkill, /usr/bin/kill, /bin/kill, /bin/true, /usr/bin/true
EOS
echo "Installing $FILE (will prompt for sudo password once)..."
sudo install -m 440 "$TMP" "$FILE"
sudo visudo -cf "$FILE"
rm -f "$TMP"
# Do not use bare "sudo -n true" alone as the only check when agents wrap with -E;
# test both NOPASSWD and SETENV explicitly.
if sudo -n -E true && sudo -n docker version >/dev/null; then
  echo "OK. passwordless_ok (sudo -n -E true + docker)"
else
  echo "WARN: passwordless sudo test failed — re-run this script interactively once." >&2
fi
# Also finish docker group + isaac init
sudo usermod -aG docker "$USER_NAME"
sudo bash /home/${USER_NAME}/Projects/agenticros/scripts/bootstrap_isaac_nemoclaw_host.sh || true
echo "Log out/in or run: newgrp docker"